What is 'tapjacking' on Android, and which specific API was introduced to allow developers to detect and reject touches made through overlays?

• A.A. Tapjacking is a UI redress attack where a malicious transparent overlay captures or redirects touch events to trick users into tapping hidden UI elements; the setFilterTouchesWhenObscured(true) attribute and View.onFilterTouchEventForSecurity() API allow views to reject touch events when the window is obscured
• B.B. Tapjacking is an NFC-based attack that intercepts contactless payment taps before they reach the payment terminal
• C.C. The mitigation for tapjacking is the SYSTEM_ALERT_WINDOW permission revocation, which blocks all overlays on Android 10+
• D.D. Android 12 automatically prevents tapjacking by blocking all TYPE_APPLICATION_OVERLAY windows in the foreground